Security1 publisher2 min readPublished
Two of the four ways past Discord's new age gate send the proof to a vendor
Discord's teen-by-default model is already enforced where local law requires it, and the global rollout is held to the second half of 2026. The route a user picks at the prompt decides whether a government ID leaves the device.
The Watch · Security desk
What happened
- Discord has moved to a teen-by-default model in which adult content access and certain safety-setting changes require age verification before the platform will allow them.
- Four actions trigger the check: unblurring sensitive content or disabling the filter, entering age-restricted channels and servers, changing Message Request Inbox settings, and speaking on a Stage channel.
- Enforcement is live only where local law requires it, and Discord's support page puts the broader global rollout in the second half of 2026 while it adds verification options and documentation.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The ID scan and card routes move the sensitive artifact off Discord's systems, so the breach question now belongs to k-ID, Stripe and the ID vendor, and Discord's own retention promises do not reach them.
- decision Every user who hits a gate makes a data-handling choice at the prompt, and the on-device selfie is the only option where nothing but an age estimate leaves the phone.
- constraint Community operators running servers across several countries cannot assume a uniform gate until the global rollout lands, because the same action prompts in one jurisdiction and passes in another.
- capability The wall goes up action by action, so most users never surrender anything. That keeps the pool of stored documents far smaller than the user count implies.
The four routes do not carry the same data. Gadget Review, reading Discord's safety materials, describes the k-ID video selfie as processed entirely on the device, with the video deleted immediately and Discord receiving only an estimated age [6]. The Google Wallet path uses a passport ID pass: Google sends Discord a birthdate, and Discord derives the age from it without keeping the date [7]. Two paths move something durable. An ID scan pairs a government-issued ID with a selfie through a vendor flow [8]. The card route pushes card details through k-ID and Stripe, and Discord says it does not retain card information and refunds any verification charge it applies [9].
Count them and the split is two paths ending in an age signal, two ending in a document image or a card number held outside Discord [10]. Gadget Review writes that Discord acknowledges those vendor pipelines without drawing attention to them [11]. Discord's stated promises cover what Discord itself keeps [7][9]. Discord has not said how long the vendor keeps the scanned ID, or which method users actually choose [14].
The size of the exposure depends on how long the ID vendor holds the document.
Enforcement today runs only where local law requires it, and the wider rollout is held until the second half of 2026 while Discord adds more verification options and documentation, per the company's support page [4]. That window opens no earlier than July 1, 2026 [13]. Until then a community spanning several countries gets gates in some of them and nothing in the rest.
The wall goes up action by action. A user who never opens an age-restricted channel and never speaks on a Stage may never see a prompt [12]. One of the four triggers is a safety setting: changing who can DM you from outside your circle sits behind the same check as unblurring sensitive content [3].
Discord said its default setup "now includes content filters, age-gated spaces, a message request inbox, and stage restrictions", all "designed to protect younger users by default" [2]. For an adult who wants those defaults loosened, the route chosen at the prompt is what determines whether a government document leaves the phone [6][8].
What to watch
- Whether Discord names the ID scan vendor and publishes a retention period before the second-half-2026 rollout.
- Whether the extra verification options Discord adds in the gap are on-device estimates or document checks.
- Whether any jurisdiction's age-assurance law requires the platform or vendor to keep the ID copy, closing off the on-device path.